Openremote vulnerabilities

Products

• Openremote 16
• Core 3

Newest

• openremote core OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId CVE-2026-116186 2.3 LowOctober 25, 2026
• openremote core OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos CVE-2026-116185 5.3 MediumOctober 25, 2026
• openremote core OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket CVE-2026-116184 2.1 LowOctober 25, 2026
• openremote OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints CVE-2026-114661 9.0 CriticalOctober 22, 2026
• openremote OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API CVE-2026-81679 8.3 HighAugust 27, 2026
• openremote OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference CVE-2026-73616 7.1 HighAugust 13, 2026
• openremote openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks CVE-2026-67310 5.3 MediumAugust 1, 2026
• openremote OpenRemote before 1.26.2 Authentication Bypass via Console Registration CVE-2026-66013 9.3 CriticalJuly 25, 2026
• openremote OpenRemote before 1.26.2 Information Disclosure via Syslog REST API CVE-2026-65009 5.3 MediumJuly 21, 2026
• openremote OpenRemote has authenticated SQL injection in crosstab datapoint exports CVE-2026-63224 Fix available 7.2 HighJuly 6, 2026
• openremote OpenRemote < 1.26.0 SQL Injection via Crosstab Export CVE-2026-62238 Fix available 7.2 HighJuly 6, 2026
• openremote, io.openremote openremote-manager +1 more OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory CVE-2026-54640 Fix available 7.6 HighJuly 6, 2026
• openremote OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl CVE-2026-54641 Fix available 7.7 HighJuly 6, 2026
• openremote OpenRemote read-only asset users can write predicted datapoints CVE-2026-49439 Fix available 4.3 MediumJuly 6, 2026
• openremote OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint CVE-2026-56784 Fix available 8.6 HighJune 19, 2026
• openremote OpenRemote has Improper Access Control via updateUserRealmRoles function CVE-2026-41166 Fix available 7.0 HighApril 22, 2026
• openremote OpenRemote has XXE in Velbus Asset Import CVE-2026-40882 Fix available 7.6 HighApril 15, 2026
• openremote OpenRemote is Vulnerable to Expression Injection CVE-2026-39842 Public exploitFix available 10.0 CriticalApril 14, 2026
• openremote An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code... CVE-2022-31860 9.8 CriticalSeptember 6, 2022